BIOTRONIK Statement on Recently Disclosed PHP Vulnerabilities

BIOTRONIK is aware of the recently disclosed critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that have received significant attention across the cybersecurity community. 

BIOTRONIK conducted a thorough review of its systems. Based on our Software Bill of Materials (SBOM), we confirmed that no PHP components are used in our medical device systems.  

All exposure to the vulnerability in adjacent and supporting services has been remediated. Immediate action was taken to upgrade or temporarily shut down affected services for maintenance. We continue to monitor our systems closely.  

To maintain high standards of cybersecurity and patient safety, BIOTRONIK continuously reviews relevant security advisories, assesses emerging vulnerabilities, and maintains an up-to-date software component inventory across products and supporting digital services. Where security updates are required, they are implemented in accordance with established risk management and cybersecurity processes. 

For vulnerabilities related to BIOTRONIK products and services, please contact productsecurity@biotronik.com.  

For vulnerabilities associated with BIOTRONIK enterprise infrastructure, please contact csirt@biotronik.com.